
where \(f(.)\)  is a forward pass of our classifier to return logits and where the accuracy of approximation is driven by the number of replicates \(H\) . Meaningful evaluation of adversarial defenses must be based on adaptive attack methods which are aware of both \(f(x)\)  and \(T(x)\) . For our attack we use the BPDA+EOT formulation from [1]}, [2]} to obtain the attack gradient
\(\Delta _\text{BPDA+EOT} (x, y) = \frac{1}{H_\text{adv}} \sum _{h=1}^{H_\text{adv}} \nabla _{\hat{x}_h} L\left(\frac{1}{H_\text{adv}} \sum _{h=1}^{H_\text{adv}} f(\hat{x}_h), y\right) , \quad \hat{x}_h \sim T(x) \text{ i.i.d.}\) 
